chore: enforce type-checking-only imports with ruff

[cloudsmith-iduffy]

Description

The perf work in this stack moved a lot of imports into if TYPE_CHECKING: blocks by hand — imports that are only needed for type annotations don't have to be paid for at runtime. This makes that a rule so it can't quietly regress.

Two ruff rule groups are now enabled:

• flake8-type-checking (TC) — if an import is only used in type annotations, it has to live in an if TYPE_CHECKING: block, which means the interpreter never actually imports it
• flake8-future-annotations (FA) — makes sure from __future__ import annotations is present where it's needed, so the moved imports stay safe without quoting every annotation

There's nothing to set up: the pre-commit ruff hook picks the rules up from pyproject.toml, and CI runs pre-commit, so both enforce it.

Turning the rules on found 8 leftover typing-only imports across 5 files, all moved in this PR. The only one that needed real thought was EnvironmentDetector in the OIDC detectors package __init__ — moving it would break anything importing it from the package, but it turns out every subclass and test already imports it from .base directly, so the package-level name was dead weight.

This mirrors how the main cloudsmith repo configures ruff (it selects the same two groups). Its stdlib-json-to-orjson ban wasn't carried over: that's a binary dependency to speed up JSON payloads that are tiny here, and imports — not parsing — were the CLI's actual bottleneck.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Lint enforcement; no behaviour change.

Additional Notes

• Files that don't have from __future__ import annotations yet (e.g. core/mcp/server.py) are left alone — ruff only offers the move where it's provably safe, which is exactly what we want from a guard.
• The existing pre-commit excludes for the test directories still apply.
• Full suite passes (801 passed, 40 skipped).

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Enforces Ruff rules for future annotations and type-checking-only imports.

Changes:

• Enables Ruff FA and TC rule groups.
• Moves annotation-only imports into TYPE_CHECKING blocks.
• Removes the runtime EnvironmentDetector package export.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Summary
pyproject.toml	Enables Ruff type-checking and future-annotations rules.
cloudsmith_cli/credential_helpers/docker/installer.py	Defers the CredentialResult import.
cloudsmith_cli/core/credentials/provider.py	Defers credential model imports.
cloudsmith_cli/core/credentials/oidc/detectors/__init__.py	Defers EnvironmentDetector; this breaks the existing package-level runtime export and requires a compatibility export or documented breaking change.
cloudsmith_cli/core/credentials/chain.py	Defers credential type imports.
cloudsmith_cli/core/cache_utils.py	Defers the Callable import.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.